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MEMORANDUM  REPORT  NUMBER  IT-A-02-02 

Streamlined  Processes  and  Better  Automation 
Can  Improve  Munitions  License  Reviews 

March  2002 


The  Department  of  State  (Department)  has  primary  federal  responsibility  for 
reviewing  and  approving  licenses  for  the  export  of  munitions  commodities  from  the 
United  States.  In  the  current  information  age,  there  are  vast  opportunities  for 
applying  technology  to  help  streamline  and  improve  the  effectiveness  of  the  licens¬ 
ing  control  process.  Given  increasing  risks  to  information  processing  in  today’s 
environment,  ensuring  security  in  the  licensing  control  process  is  also  essential. 

In  response  to  requirements  of  the  National  Defense  Authorization  Act  for  FY 
2000, 1  the  Office  of  Inspector  General  (OIG)  conducted  a  review  of  automation  in 
the  Department’s  munitions  export  licensing  process.  Specific  objectives  of  our 
review  were  to  (1)  evaluate  the  processes  and  information  systems  used  by  the 
Department  for  reviewing  munitions  export  license  applications,  including  an  assess¬ 
ment  of  systems  connectivity  with  relevant  Department  bureaus  and  other  federal 
agencies,  (2)  determine  whether  the  licensing  systems  comply  with  federal  and 
Departmental  security  assurance  requirements,  and  (3)  assess  whether  the  Depart¬ 
ment  is  carrying  out  ongoing  and  planned  upgrades  to  the  licensing  systems  in  a 
cost-effective  and  efficient  manner.  The  purpose,  scope,  and  methodology  for  our 
review  are  outlined  on  page  23. 


Results  in  Brief 


The  munitions  export  licensing  process  is  crucial  to  safeguard  the  foreign  policy  and 
national  security  interests  of  the  United  States.  However,  the  process  as  managed  by 
the  Department’s  Office  of  Defense  Trade  Controls  (DTC)  is  inefficient  and  unnec¬ 
essarily  burdensome  on  industry  and  other  federal  agencies  involved  in  munitions 
license  controls.  OIG  found  that  the  process  involves  extensive  use  of  manual  and 
paper-based  means  to  transfer  information  that  must  be  re-keyed  into  computer 
systems  by  recipient  organizations.  In  addition,  the  process  lacks  adequate  tracking 


1  Public  Law  106-65,  Title  XIV,  Section  1402,  113  Stat  798  (2000);  22  U.S.C.  2778  nt  (2001). 
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mechanisms  from  beginning  to  end,  resuldng  in  lost  and  misplaced  applications,  as 
well  as  additional  time  and  effort.  In  part,  these  problems  have  resulted  from  DTC’s 
internal  information  technology  (IT)  infrastructure,  which  is  comprised  of  multiple 
systems  that  are  independent  of  one  another.  DTC’s  lack  of  external  connectivity 
further  limits  its  ability  to  share  data  electronically  with  other  organizations,  such  as 
the  Department  of  Defense,  also  involved  in  reviewing  and  approving  munitions 
licenses. 

DTC  recognizes  the  need  to  improve  its  munitions  licensing  processes  and 
related  information  systems  and  is  now  developing  plans  to  upgrade  its  IT  capabili¬ 
ties.  However,  its  approach  focuses  primarily  on  automating  aspects  of  the  existing 
process  and  does  not  include  effective  risk  management  strategies  or  adequate 
industry  and  agency  input  to  help  identify  and  meet  requirements.  Not  revising 
business  processes  prior  to  investing  in  new  technology  creates  the  risk  of  merely 
automating  inefficient  ways  of  doing  business.  Failure  to  coordinate  effectively  with 
external  export  licensing  organizations  grappling  with  similar  IT  improvement  issues 
results  in  duplication  of  effort. 

Recent  DTC  initiatives  are  good  first  steps  to  improving  automated  support  for 
the  munitions  licensing  process;  however,  more  needs  to  be  done  for  the  efforts  to 
be  effective.  Building  upon  initiatives  currently  underway,  DTC  can  broaden  its 
efforts  to  include  assessment  of  the  existing  munitions  licensing  process  and  identifi¬ 
cation  of  improvement  requirements.  Working  with  industry  and  other  federal 
government  organizations  involved  in  the  process,  DTC  can  help  develop  a  strategy 
for  providing  secure,  integrated  systems  and  processes  to  help  meet  these  require¬ 
ments.  DTC  has  taken  tentative  steps  toward  improved  collaboration;  however, 
sustained  interagency  effort  is  necessary  to  improve  automation,  integrate,  and 
streamline  the  federal  munitions  licensing  process  as  a  whole. 


Background 


Export  licensing  controls  are  vital  to  help  protect  the  national  security,  foreign  policy, 
and  nonproliferation  interests  of  the  United  States.  Export  licenses  are  controlled 
through  two  separate  processes  for  dual-use  and  munitions,  based  on  the  intended 
use  of  the  commodities  involved.  Dual-use  commodities  arc  those  goods  and 
technologies,  such  as  supercomputers,  encryption  equipment,  and  nuclear-related 
items,  which  have  both  commercial  and  military  purposes.  Munitions  commodities 
are  services  or  items,  such  as  firearms,  aircraft,  radar  systems,  and  ammunitions, 
which  arc  designated  for  strictly  military  or  defense  purposes. 
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The  Bureau  of  Export  Administration  at  the  Department  of  Commerce  controls 
dual-use  exports  under  the  authority  of  the  Export  Administration  Act  of  1979,  50 
U.S.C.  2401  et  seq.  (2000),  as  amended.  The  Export  Administration  Regulations,  15 
C.F.R.  Subchapter  C  (2001),  published  by  die  Bureau,  outline  export  control  policies, 
procedures  for  issuing  export  licenses,  and  laws  and  guidelines  for  enforcing  dual-use 
exports.  Within  the  Department,  two  organizations  assist  Commerce  in  the  dual-use 
licensing  process,  with  each  reviewing  specific  types  of  commodides.  The  Bureau  of 
Nonproliferation  reviews  dual-use  license  applications  for  national  security  and 
regional  stability  concerns.  The  Bureau  of  Economic  and  Business  Affairs  reviews 
dual-use  license  applications  for  crime  control  and  foreign  policy  reasons. 

Within  the  Department’s  Bureau  of  Political-Military  Affairs,  DTC  controls  the 
export  of  munitions  under  the  authority  of  the  Arms  Export  Control  Act,  22  U.S.C. 
2751  et  seq.  (2001).  Although  the  Act  authorizes  the  President  to  control  the  export 
of  items  included  on  the  U.S.  Munitions  List,  the  President  delegated  this  responsi¬ 
bility  to  the  Secretary  of  State  in  1977  by  Executive  Order  11958.  DTC  provides 
foreign  policy  advice  to  entities  involved  in  manufacturing,  exporting,  and  brokering 
defense  articles  and  services.  DTC  also  reviews  and  approves  munitions  license 
applications  in  accordance  with  the  International  Traffic  in  Arms  Regulations,  22 
C.F.R.  Subchapter  M  (2001),  which  specifies  procedures  that  persons  subject  to  U.S. 
jurisdiction  must  follow  in  furnishing  defense  articles  or  services  abroad.  DTC  has 
its  own  process  for  reviewing  and  approving  munitions  export  license  applications 
in-house,  but  also  forwards  many  of  these  applications  to  other  organizations  inter¬ 
nal  and  external  to  the  Department  for  review. 

Recent  reports  by  organizations  such  as  the  Center  for  Strategic  and  Interna¬ 
tional  Studies2  have  expressed  concerns  over  the  efficiency  of  the  federal 
government’s  export  licensing  control  process,  characterizing  the  process  as  unneces¬ 
sarily  complex  and  cumbersome.  In  recent  years,  OIG  has  had  an  ongoing  role  in 
evaluating  the  effectiveness  of  the  Department’s  export  licensing  control  processes, 
with  a  specific  focus  on  munitions  licensing.  For  example,  in  June  1999,  OIG 
reported  that  the  process  for  monitoring  end-use  of  munitions  export  licenses  could 
be  improved  by  placing  more  emphasis  on  selection  criteria  for  end-use  monitoring, 
overseeing  monitoring  requests,  and  ensuring  adequate  technical  expertise  at  overseas 
posts  for  conducting  checks.3  In  March  2000,  OIG  reported  that  DTC  did  not 
systematically  track  foreign  nationals  listed  on  munitions  export  licenses.4  OIG 

2  Final  Report,  Study  Group  on  Enhancing  Multilateral  Export  Controls  for  US  National  Secu¬ 
rity,  The  Henry  L.  Stimson  Center,  Center  for  Strategic  and  International  Studies,  Washington, 
DC,  April  2001. 

3  Export IJcen.vng  y)9-Cl-01  HJ. 

4  Department  of  S fa/e  Controls  Oierf&e  Transfer  f  M f titan f  Sensttine  Teatwo/ogks  to  Foreign  Nationa/s from 
Countries  and Entities  f  Concern  /00-CI-008y! 
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determined  that  although  licensing  agreements  may  have  been  in  place  to  protect 
against  the  release  of  sensitive  information  to  foreign  nationals,  the  risk  of  unautho¬ 
rized  disclosure  persisted. 

More  recently,  in  March  2001,  OIG  found  that  DTC’s  commodity  jurisdiction 
process  for  determining  whether  an  export  is  subject  to  the  U.S.  Munitions  List  took 
an  extensive  amount  of  time — an  average  of  six  and  one-half  months.5  OIG  further 
reported  that  DTC  did  not  have  computer  interfaces  with  other  agencies  involved  in 
the  commodity  jurisdiction  process  or  a  computer  database  providing  history  on 
specific  types  of  commodities.  OIG  recommended  that  DTC  develop  commodity 
jurisdiction  notification  procedures  and  deadlines  and  work  with  the  Departments  of 
Commerce  and  Defense  to  institute  a  secure,  automated  system  for  processing, 
referring,  and  storing  historical  export  license  data. 


Overview  of  the  Current  Munitions  Export  Licensing 
Process 


The  U.S.  process  for  controlling  munitions  exports  involves  license  application 
review  by  a  number  of  different  Department  and  other  federal  organizations.  These 
organizations  are  responsible  for  ensuring  that  exports  are  reviewed  in  accordance 
with  U.S.  foreign  policy,  national  security,  and  nonproliferation  objectives.  Figure  1 
provides  a  flow  chart  of  the  major  steps  in  the  process,  which  we  also  discuss  in 
further  detail  below. 


5  Review  of  tie  U.S.  Munitions  List  a»d ii>e  Commodity Jumdiciioft  Process  ,Ol-FP-M-027 ' J. 
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Figure  1:  Illustration  of  the  Current  Munitions  Export  Licensing  Process 


Industry  mails  or  submits  hard 
copy  of  license  application  to 
DTC  with  supporting 
documentation 


Industry  electronically  submits  I 
|  license  application  via  ELLIE  or  [ 
ROBB  and  mails  supporting 
documentation 


application 

- 

supporting 

documentation 

ELLIE  -  Electronic  License  Entry  System 
ROBB  -  Remote  Online  Bulletin  Board 
DETRA  -  Defense  Trade  Application 
AECA  -  Arms  Export  Control  Act 
ITAR  -  International  Traffic  in  Arms  Regulations 


Source:  U.S.  Department  of  State,  Office  of  Inspector  General 
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The  process  begins  with  industry,  which  has  several  options  for  submitting  a 
munitions  export  license  application  to  DTC: 

•  Hard  copy  through  either  mail,  courier,  or  hand-delivery; 

•  Electronically  through  the  Internet  using  DTC’s  Electronic  License  Entry 
System;  and 

•  Dial-up  server  to  DTC’s  Remote  Online  Bulletin  Board. 

When  a  hard  copy  or  electronic  license  application  is  received  from  industry, 
DTC  transfers  information  from  the  license  request  to  its  Defense  Trade  Application 
system.  This  application,  developed  from  a  commercially  available  database  system, 
is  used  for  a  variety  of  licensing  and  export  compliance  activities,  including  tracking 
license  applications,  scanning  supporting  materials,  and  querying  license  approval 
status.  Each  application  is  assigned  a  case  number  and  then  distributed  to  a  licensing 
team  within  the  office  for  review.  The  licensing  officer  assigned  to  the  case  performs 
an  initial  review  of  the  application  to  determine  whether  it  is  accurate  and  complete. 
If  the  application  is  not  complete  or  is  not  properly  prepared,  it  is  returned  without 
action  to  the  applicant.  Complete  applications  are  reviewed  and  approved  by  DTC 
without  external  involvement  or  referred  to  other  Department  or  federal  organiza¬ 
tions  for  additional  review.  DTC  staffs  out  about  one-third  of  the  approximately 
45,000  license  applications  it  receives  annually  for  additional  review  and  comment. 

More  than  half  of  the  license  applications  that  DTC  annually  staffs  out  are  sent 
to  various  bureaus  and  offices  within  the  Department.  These  organizations  include 

•  the  Bureau  of  Democracy,  Human  Rights,  and  Labor; 

•  the  Office  of  Regional  Security  Arms  Transfer  Policy; 

•  the  Bureau  of  International  Environmental  Scientific  Affairs;  and 

•  the  regional  bureaus. 

The  organizations  review  the  applications  for  policy,  human  rights,  and  environmen¬ 
tal  implications.  The  bureaus  may  also  refer  applications  to  country  desks  or  other 
offices  within  the  Department  for  further  review. 

External  to  the  Department,  the  Department  of  Defense  (Defense)  plays  a 
significant  role  in  conducting  national  security  reviews  of  munitions  export  license 
applications.  Defense  reviews  about  14,000  cases  of  the  annual  licensing  workload 
that  DTC  sends  out  for  external  review.  DTC  transfers  boxes  of  these  cases  to  the 
Defense  Technology  Security  Administration  (DTSA)  every  day.6  A  DTSA  cm- 

6  In  August  2001,  Defense  renamed  the  former  Defense  Threat  Reduction  Agency  as  the  De¬ 
fense  Technology  Security  Administration. 
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ployce  creates  an  inventory  of  the  license  applications  using  a  commercially  available 
word  processing  application  and  places  the  inventory  in  a  logbook.  Cases  arc  then 
input  to  Defense’s  Foreign  Disclosure  and  Technical  Information  System  and  re¬ 
ferred  to  licensing  officers  who  determine  how  further  to  staff  out  the  cases  to 
Defense  component  agencies.  After  receiving  position  papers  from  all  of  the  De¬ 
fense  components  asked  to  review  a  case,  DTSA  compiles  a  final  Defense  position 
on  a  license  application.  DTSA  transmits  the  final  Defense  position  to  DTC  elec¬ 
tronically  via  an  unclassified  Department  server.  In  some  instances,  other  agencies 
such  as  the  Department  of  Energy  (Energy)  and  the  National  Aeronautics  and  Space 
Administration  (NASA)  are  also  involved  in  munitions  license  application  reviews, 
but  to  a  substantially  less  extent  than  Defense. 

DTC  staff  assistants  maintain  computerized  files  on  each  license  application 
throughout  the  internal  and  external  review  process.  When  all  positions  are  received 
on  a  given  case,  the  staff  aides  enter  the  reviewers’  positions  into  the  Defense  Trade 
Application  and  close  the  case,  transferring  it  to  the  responsible  licensing  officer  for 
final  review  and  action.  If  reviewing  agencies  recommend  that  DTC  deny  a  license, 
the  case  is  held  up  until  a  weekly  meeting  at  which  it  is  determined  whether  an 
applicant  should  be  allowed  to  protest  under  the  Department’s  Appeal  Review 
Process.  However,  if  DTC  receives  recommendations  from  all  reviewers  that  a 
license  application  should  be  approved,  and  DTC  agrees  with  the  recommendations, 
DTC  issues  the  license  to  the  exporter. 

At  the  end  of  the  license  review  process,  DTC  coordinates  with  the  U.S.  Cus¬ 
toms  Service  (Customs)  to  ensure  enforcement  of  approved  licenses  in  accordance 
with  requirements  of  the  Arms  Export  Control  Act  and  the  International  Traffic  in 
Arms  Regulations.  DTC  sends  information  on  approved  licenses  to  Customs  on  a 
daily  basis.  At  the  point  of  departure,  Customs  inspectors  verify  that  exporters  have 
valid  licenses  before  goods  are  shipped  overseas.  When  a  license  has  expired  or  been 
exhausted.  Customs  returns  the  license  to  the  Department  in  accordance  with  export 
control  regulations. 


Current  Munitions  Licensing  Process  Is  Fragmented 

and  Inefficient 


The  munitions  export  licensing  process  discussed  above  has  been  in  place  for  de¬ 
cades.  The  intricate  series  of  checks  and  balances  inherent  to  the  process  has  sup¬ 
ported  the  federal  government  in  meeting  its  objective  of  authorizing  for  export  only 
those  military  goods  and  technologies  that  are  not  contrary  to  U.S.  interests  abroad. 
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As  technology  has  evolved,  DTC  and  related  organizations  have  independently 
introduced  automated  systems  and  other  technologies  in  an  unintegrated  manner  to 
aid  in  carrying  out  their  individual  export  licensing  responsibilities.  However,  even 
while  the  ad  hoc  application  of  technology  has  facilitated  export  license  review  in 
certain  areas  of  the  process  as  a  whole,  it  has  also  contributed  to  inefficiencies  in  a 
number  of  ways.  The  proliferation  of  unintegrated  systems  linked  by  manual  and 
paper-based  processes,  re-keying  of  data,  inadequate  tracking,  and  a  consequent  lack 
of  timeliness  are  deficiencies  that  we  identified  in  the  current  munitions  export 
licensing  process.  To  avoid  the  information  security  risks  that  connectivity  poten¬ 
tially  imposes,  DTC  has  chosen  to  maintain  its  current  IT  infrastructure  instead  of 
moving  to  a  more  interoperable  environment  that  supports  secure  and  more  efficient 
electronic  exchange  of  data  among  all  participants  in  the  review  process. 


Lack  of  Systems  Connectivity 

Office  of  Management  and  Budget  Circular  A- 130  requires  agencies  to  develop 
information  systems  that  facilitate  interoperability  across  networks  of  heterogeneous 
hardware,  software,  and  telecommunications  platforms.  Currently,  however,  the 
systems  that  DTC  uses  to  process  munitions  export  license  applications  are  indepen¬ 
dent  of  one  another.  For  example,  the  Defense  Trade  Application — DTC’s  primary 
licensing  system — has  no  connectivity  with  either  the  web-based  Electronic  License 
Entry  System  or  the  dial-up  Remote  Online  Bulletin  Board  that  DTC  has  provided 
for  industry  to  submit  license  applications.  DTC  uses  three  different  servers  and 
networks  to  operate  these  systems.  The  Defense  Trade  Application  is  also  not  part 
of  the  IT  infrastructure  or  connected  to  any  other  system  internal  to  the  Depart¬ 
ment.  DTC  coordination  with  the  Department’s  other  bureaus  and  offices  is  gener¬ 
ally  conducted  through  manual  exchange  of  licensing  data. 

Other  federal  organizations  also  have  their  own  unintegrated  systems  for  pro¬ 
cessing  munitions  export  license  applications  referred  to  them  by  DTC.  Specifically, 
at  Defense,  DTSA  has  a  Foreign  Disclosure  and  Technical  Information  System  for 
processing  munitions  license  applications  referred  from  DTC.  Energy  uses  its 
Proliferation  Information  Network  System  to  review  export  license  applications. 

The  Energy  system  is  classified  and  does  not  allow  for  the  direct  transmittal  of 
license  decisions  to  other  federal  agencies.  The  Automated  Export  System  is  a  joint 
venture  between  Customs  and  the  Bureau  of  Census  for  electronic  filing  of  shippers’ 
export  declarations  and  outbound  manifests.  Though  a  number  of  other  federal 
agencies  use  the  Automated  Export  System,  DTC  currently  has  no  direct  link  to  the 
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system.  This  lack  of  systems  connectivity  among  the  various  agencies  involved  in 
export  licensing  contributes  to  a  number  of  inefficiencies  that  we  identified  in  the 
munitions  export  licensing  process. 


Manual  and  Paper-based  Processes 

The  Paperwork  Reduction  Act  of  1995,  44  U.S.C.  3501  et  seq.  (2001),  requires 
agencies  to  acquire,  manage,  and  use  IT  to  improve  mission  performance  and  mini¬ 
mize  the  information  collection  burden  on  the  public.  However,  much  of  the 
munitions  licensing  process  remains  largely  manual  or  paper-based.  DTC’s  coordina¬ 
tion  with  the  various  participants  in  the  license  review  process  is  characterized  by  the 
exchange  of  substantial  amounts  of  hard  copy  information  to  help  compensate  for 
the  lack  of  systems  connectivity.  For  example, 

•  Industry:  DTC  requires  that  industry  provide  an  original  and  eight  cop¬ 
ies  of  each  license  application  and  supporting  documentation.  Currently,  60 
percent  of  all  license  applications  are  submitted  to  DTC  electronically.  The 
remainder  are  sent  through  the  mail  or  hand-delivered.  Even  though  applica¬ 
tions  may  be  electronically  submitted,  supporting  documentation  must  still 
be  provided  in  hard  copy  by  mail,  fax,  or  courier  and  matched  with  the  elec¬ 
tronic  submissions — a  labor,  time,  and  resource-intensive  exercise.  Delays 
sometimes  occur  when  exporters  do  not  provide  the  supporting  documenta¬ 
tion  within  30  days  of  the  application  as  required.  DTC  staff  then  must  fol¬ 
low  up  with  telephone  calls  to  locate  the  additional  information. 

•  Department  of  State  Bureaus  and  Offices:  All  license  applications  that 
DTC  sends  to  other  organizations  within  the  Department  for  review  are 
transmitted  by  interoffice  mail,  fax,  or  hand-delivery.  For  example,  for  a 
given  case,  DTC  sends  the  bureaus  a  copy  of  the  application  and  all  support¬ 
ing  documentation,  including  detailed  technical  data  that  can  range  from  a 
few  sheets  to  hundreds  of  pages.  Bureau  officials  indicated  that  much  of 
this  information  is  unnecessary  for  the  types  of  review  that  they  conduct. 

They  generally  stated  that  they  require  only  country  names,  item  descriptions, 
and  end-user  information  to  make  license  determinations.  The  excess  data 
increases  the  workload  of  the  bureaus  that  have  to  forward  the  paper  copies 
to  other  offices  within  the  Department  for  review. 

•  Defense:  Each  day  a  courier  delivers  to  DTSA  five  copies  of  each  appli¬ 
cation  submitted  to  DTC,  along  with  supporting  documentation.  DTSA 
then  forwards  the  applications  to  various  Defense  components,  such  as  the 
Military  Services  or  engineering  organizations  that  review  over  90  percent  of 
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the  cases  that  DTSA  receives.  DTSA  sorts  the  applications  by  technology 
area  into  nine  groups,  including  electronic  warfare,  aircraft,  and  space  and 
missile  technology.  The  process  could  be  more  efficient  if  the  sorting  were 
done  electronically.  DTC  could  also  reduce  costs  by  transferring  data  elec¬ 
tronically,  eliminating  the  need  for  a  courier  each  day. 

•  U.S.  Customs:  The  Proliferation  Prevention  Enhancement  Act  of  1999, 
13  U.S.C.  301  (2001),  requires  that,  by  March  2002,  all  exporters  will  use  the 
Automated  Export  System  for  filing  shipper’s  export  declarations  electroni¬ 
cally  to  Customs.  To  date,  over  80  percent  of  exporters  are  using  this  auto¬ 
mated  system,  which  has  helped  Customs  increase  efficiency,  reduce  the 
amount  of  paper  documents  it  receives,  and  improve  enforcement  capability. 
Currently,  Department  regulations  require  exporters  to  present  paper  copies 
of  shippers’  export  declarations  at  ports  of  exit.  DTC  representatives  have 
stated  that  they  are  working  with  Customs  to  modify  the  Automated  Export 
System  to  meet  munitions  export  regulatory  requirements  so  that  filing  of 
shipper’s  export  declarations  can  be  handled  electronically. 


Re-keying  of  Data 

Given  the  paper-based  exchange  of  data  among  participating  organizations,  the  same 
license  application  information  has  to  be  input  to  computer  systems  multiple  times. 
For  example,  DTC  staff  must  re-key  or  scan  the  electronic  license  applications  they 
receive  from  their  stand  alone  application  systems  into  the  Defense  Trade  Applica¬ 
tion.  DTC  also  contracts  with  a  third  party  to  enter  data  from  hard  copy  mail 
applications  into  an  electronic  format.  The  third  party  contractor  e-mails  DTC  with 
electronic  versions  of  the  paper  forms. 

Reviewers  at  Defense  and  Energy  scan  or  type  the  data  received  from  DTC  into 
their  own  systems.  DTSA  officials  told  us  that  they  have  eight  export  control  spe¬ 
cialists  who  spend  between  five  and  ten  minutes  entering  data  into  the  Foreign 
Disclosure  and  Technical  Information  System  to  create  a  routine  case.  The  time 
required  for  data  entry  increases  to  more  than  30  minutes  for  agreements.  Agree¬ 
ments  arc  submitted  in  letter  format  rather  than  via  standard  application  forms. 

Many  of  the  agreements  contain  a  great  deal  of  legal  terminology,  malting  them 
more  difficult  and  time-consuming  to  review.  The  number  of  agreements  submitted 
has  been  increasing  every  year.  Currently,  50  percent  of  the  total  license  applications 
DTSA  reviews  involve  agreements. 
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Lack  of  Tracking  Results  in  Lost  and 
Misplaced  Applications 

Due  to  the  multiple,  unintegrated  systems  involved,  there  is  a  lack  of  transparency 
and  a  greater  potential  for  error  in  the  munitions  export  licensing  process.  Currently, 
each  organization  to  which  DTC  refers  a  license  for  review  has  responsibility  only 
for  tracking  the  license  from  the  time  of  referral  until  the  time  the  license  is  returned 
to  DTC.  There  is  no  single  means  of  tracking  throughout  the  process  from  initial 
submission  to  final  disposition.  For  example,  some  bureaus  use  manual  methods  to 
track  applications  that  they  receive  from  DTC  or  forward  to  other  offices  within  the 
Department  for  review.  Other  bureaus  do  not  track  the  cases  at  all.  Defense  also 
has  its  own  system  for  tracking  export  license  applications,  which  uses  an  entirely 
different  case  numbering  system  from  that  of  the  Department. 

Using  the  Electronic  License  Entry  System,  exporters  can  check  the  status  of 
their  license  applications.  For  example,  via  the  system,  exporters  can  determine 
whether  and  when  DTC  received  their  applications  or  referred  diem  to  other  organi¬ 
zations  for  review.  They  can  also  determine  when  reviews  have  been  completed.  A 
major  limitation,  however,  is  the  fact  that  the  system  is  not  available  to  other  bureaus 
and  offices  within  the  Department  or  external  organizations  involved  in  the  reviews. 
In  addition,  exporters  stated  that  the  system  does  not  always  reflect  what  happens  to 
a  license  after  it  has  left  DTC.  They  said  that  the  system  may  indicate  that  a  license 
application  has  been  sent  to  a  specific  organization,  although  the  intended  recipient 
may  have  never  received  the  application  and  may  not  even  be  aware  of  the  referral. 
Industry  and  bureau  representatives  said  that  exporters  tend  to  make  frequent  calls 
to  reviewing  organizations  to  check  on  the  status  of  applications  rather  than  rely  on 
DTC’s  electronic  licensing  system.  This  lack  of  a  tracking  mechanism  to  support  the 
entire  review  process  results  in  errors  and  delays  in  license  application  processing. 
Additional  time  is  required  to  process  applications  when  they  become  lost  or  mis¬ 
placed  after  DTC  sends  them  through  interoffice  mail  to  other  bureaus  or  offices. 
Bureau  representatives  whom  we  interviewed  stated  that  that  they  frequently  receive 
applications  that  were  intended  for  other  organizations  within  the  Department. 

They  further  stated  that  they  often  receive  calls  from  industry  or  DTC  asking  about 
the  status  of  license  applications  that  they  never  received. 

A  December  2001  U.S.  General  Accounting  Office  (GAO)  report  provides 
greater  detail  about  the  conditions  that  cause  delays  in  the  licensing  process.7  Specifi¬ 
cally,  GAO  reported  that  the  Department  lacks  procedures  to  monitor  the  flow  of 

1  Reengineering  Business  Processes  Can  ln/firore  Efficiency'  of  .  ftate  Department  License  Reriem,  U.S.  General 
Accounting  Office  (GAO-02-203,  December  2001). 
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license  applications  as  they  move  from  one  stage  in  the  review  process  to  the  next. 
As  a  result,  there  is  no  assurance  that  agencies  are  conducting  timely  reviews  of 
referred  applications,  that  license  application  referrals  are  received  when  they  arc  sent 
through  the  mail  or  by  courier,  and  that  applications  that  are  lost  or  delayed  are 
quickly  identified.  The  GAO  report  concluded  that  hundreds  of  munitions  applica¬ 
tions  were  lost  and  thousands  were  delayed  in  fiscal  year  2000  due  to  the  lack  of 
procedures  and  a  system  to  track  applications. 


Lack  of  Timeliness 

Overall,  the  lack  of  systems  connectivity  contributes  to  a  lack  of  timeliness  in  the 
munitions  export  licensing  process.  As  discussed  above,  voluminous  shipments  of 
hard  copy  license  information  and  re-keying  of  data  require  added  time.  Time  is  also 
consumed  by  efforts  to  locate  lost  or  misplaced  applications.  DTC’s  own  statistics 
reflect  the  fact  that  munitions  export  license  applications  sent  out  for  review  take 
considerably  more  time  than  applications  that  remain  within  DTC  for  processing  and 
approval.  According  to  DTC’s  web  page,  the  median  processing  time  for  cases  that 
were  sent  out  for  review  in  September  2001  was  60  days  compared  to  ten  days  for 
applications  that  were  not  sent  out  during  the  same  period. 

Similarly,  a  June  2001  GAO  report  on  export  license  processing  times  at  the 
Department  and  Commerce  concluded  that  average  processing  times  were  similar 
for  both  agencies.8  The  report  indicated  that  in  FY  2000,  the  average  processing 
time  for  munitions  applications  that  DTC  did  not  refer  to  other  organizations  was  23 
days,  in  contrast  to  an  average  of  91  days  required  for  applications  that  the  office 
sent  out  for  review.  The  report  further  stated  that  4,550  applications  out  of  a  total 
of  15,512— nearly  one-third — of  the  license  applications  that  DTC  sent  out  for 
review  took  over  90  days  to  be  completed. 

Further,  industry  representatives  whom  we  interviewed  emphasized  that  much 
of  the  responsibility  for  the  license  processing  delays  rests  with  DTC.  The  represen¬ 
tatives  agreed  that  the  front-end  of  the  process — the  initial  processing  of  license 
applications— needs  improvement.  For  example,  representatives  said  that  when  they 
submit  applications  in  hard  copy  format,  it  sometimes  takes  days  for  DTC  staff  to 
log  the  applications  into  the  Defense  Trade  Application.  By  using  DTC’s  Electronic 


8  S/a/e  arc/  Commerce  Department  License  Review  Times  Are  SimiLr,  U.S.  General  Accounting  Office 
(GAO-01 -528,  June  2001). 
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License  Entry  System  to  check  the  status  of  their  applications,  they  determined  that 
it  frequently  takes  DTC  weeks  to  send  license  applicadons  out  for  review.  Further, 
according  to  one  industry  representative,  DTC  takes  seven  to  ten  days  to  input  the 
status  of  a  license  application  into  the  Electronic  License  Entry  System  after  De¬ 
fense  has  completed  its  review  Another  industry  representative  said  that  at  the  end 
of  the  review  process  it  might  take  several  days  for  DTC  to  issue  a  license  approval. 

Additionally,  in  its  December  2001  report,  GAO  stated  that  the  delays  within 
DTC  at  the  beginning  and  end  of  the  license  review  process  were  due  to  a  lack  of 
procedures  to  promote  timeliness.  Specifically,  for  FY  2000,  GAO  found  that: 

•  586  applications  took  over  two  weeks  to  be  referred  from  a  licensing  officer  to 
another  bureau  or  office  within  the  Department  or  to  a  federal  agency  for 
review; 

•  1,861  applications  took  over  two  weeks  to  be  referred  within  DTC  from  adminis¬ 
trative  personnel  to  licensing  officers  for  a  decision  after  receipt  of  recommenda¬ 
tions  from  all  external  reviewing  parties;  and 

•  330  applications  took  over  two  weeks  to  be  sent  back  to  the  applicant  after  the 
licensing  officer  had  made  a  decision  to  approve,  deny,  or  return  the  application 
without  action. 

Of  the  2,777  instances  identified  above,  674  took  over  four  weeks  to  move  from  one 
point  to  the  next  with  no  substantive  review  of  the  applications  occurring.  GAO 
also  identified  254  instances  where  applications  were  lost  in  the  transfer  from  the 
licensing  office  to  a  reviewing  office  or  agency 

DTC  officials  generally  attributed  the  increase  in  munitions  license  processing 
times  over  the  past  few  years  to  the  loss  of  several  experienced  licensing  officers,  an 
increase  in  the  number  of  license  agreement  applications  that  generally  require  more 
review  time,  and  the  transfer  of  licensing  jurisdiction  over  commercial  satellites  from 
Commerce  to  the  Department  in  March  1999.  While  we  agree  that  these  may  be 
underlying  causes,  evidence  provided  indicates  that  the  lack  of  systems  connectivity 
also  contributes  to  the  longer  processing  times. 
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Systems  Integration  Would  Improve  Efficiency 
of  the  Licensing  Process 

Many  of  the  problems  identified  above  could  be  resolved  through  improved  automa¬ 
tion  and  greater  systems  interoperability  to  support  the  munitions  export  licensing 
process.  However,  DTC  officials  oppose  connectivity  on  the  basis  that  there  are 
fewer  information  security  risks  to  unintegrated  systems.  While  not  classified,  much 
of  the  munitions  license  data  diat  DTC  manages  is  proprietary  in  nature.  Unautho¬ 
rized  disclosure  or  modification  could  have  adverse  impact  on  the  industries  in¬ 
volved,  the  integrity  of  the  export  control  process,  and  the  national  security  interests 
of  the  U.S.  as  a  whole.  With  such  arguments  as  a  basis,  however,  DTC’s  information 
assurance  strategy  has  been  one  of  risk  avoidance — remaining  isolated  to  eliminate 
the  potential  for  unauthorized  access  or  malicious  intrusion — rather  than 
prioritization  and  risk  management.  Lacking  systems  interoperability,  DTC  has  also 
preserved  the  ability  to  adapt  its  system  quickly  to  meet  internal  objectives  without 
having  to  consider  the  needs  of  other  external  agencies  or  organizations. 

Even  while  justified  in  its  concern  for  the  information  security  of  its  licensing 
processes,  DTC’s  strategy  of  retaining  unintegrated  systems  to  avoid  rather  than 
manage  security  risks  is  inappropriate  in  the  current  federal  IT  environment.  For 
example,  Office  of  Management  and  Budget  Circular  A-130  specifically  requires  that 
agencies  “protect  government  information  commensurate  with  the  risk  and  magni¬ 
tude  of  harm  that  could  result  from  the  loss,  misuse,  or  unauthorized  access  to  or 
modification  of  such  information.”  The  Department’s  Systems  Security  Program 
Plan  reinforces  this  principle  of  risk  management  in  information  security  with  the 
admonition  that  efforts  to  eliminate  all  risks  facing  information  systems  are  not  cost- 
effective. 

DTC’s  unintegrated  systems  approach  is  also  outdated  in  light  of  the  IT  capabili¬ 
ties  available  in  the  current  information  age.  Officials  we  interviewed  suggested  that 
interoperability  could  be  achieved  through  institution  of  a  single  system  accessible  to 
all  parties  involved  in  the  licensing  process — from  initial  application  through  final 
disposition.  Others  stated  that  it  could  also  be  accomplished  through  a  “system  of 
systems”— a  series  of  standards  and  integrated  systems  to  support  the  electronic 
exchange  of  information  among  the  various  Department  and  other  federal  organiza¬ 
tions  involved  in  the  munitions  export  license  review  process.  Further,  many  have 
suggested  a  variety  of  security  mechanisms — firewalls,  encryption  devices,  and 
public  key  infrastructure  strategies — that  DTC  could  use  to  support  interoperability 
and  protect  proprietary  export  licensing  data  from  unauthorized  access  and  disclo- 
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sure.  Whatever  the  approach,  electronic  exchange  of  data  would  provide  greater 
capability  and  efficiency  in  the  munidons  licensing  process  in  terms  of  improved 
access,  standardisation,  tracking,  accuracy,  and  timeliness,  as  well  as  less  duplication 
of  effort. 

In  accordance  with  Government  Paperwork  Elimination  Act9  requirements, 
other  federal  agencies  are  increasingly  moving  to  electronic  sharing  and  exchange  of 
data  to  accomplish  mutual  goals  and  overlapping  missions.  For  example,  recent 
legislation  requires  electronic  access  by  the  Department  and  the  Immigration  and 
Naturalization  Service  to  criminal  history  records  of  visa  applicants  seeking  admis¬ 
sion  to  the  United  States  to  support  counterterrorist  activities.10  Further,  in  the 
aftermath  of  the  U.S.  embassy  bombings  in  Kenya  and  Tanzania,  the  Chief  Informa¬ 
tion  Officers  of  ten  foreign  affairs  agencies  are  working  to  implement  a  web-based 
collaboration  system  that  will  improve  information  sharing  among  40  agencies  at 
overseas  posts.  The  system  is  designed  to  support  counterterrorism  and  protect  U.S. 
foreign  affairs  personnel  overseas.  The  Department  is  funding  the  prototype  and 
pilot  test  of  the  system,  with  the  Department’s  Chief  Information  Officer  acting  as 
its  lead  architect.  If  integrated  systems  can  be  established  for  sharing  critical  visa 
and  foreign  affairs  information,  connectivity  can  also  be  introduced  to  support 
secure  processing  of  export  licensing  data  that  is  only  proprietary  in  nature. 


DTC  Automation  Improvement  Initiatives  Fall  Short 


Recognizing  the  need  for  improvement,  DTC  has  taken  some  first  steps  to  automate 
the  munitions  export  licensing  process  better.  However,  its  strategy  of  automating 
certain  aspects  of  the  existing  process  without  improving  connectivity  has  only 
perpetuated  existing  inefficiencies.  DTC  has  not  assessed  the  level  of  information 
security  needed  to  migrate  to  an  interoperable  systems  environment  and  eliminate 
such  inefficiencies.  Not  involving  all  munitions  licensing  organizations  in  its  automa¬ 
tion  initiatives  has  also  hindered  DTC  from  identifying  and  addressing  process 
improvement  and  systems  requirements.  Further,  by  working  independently  to 
modernize  IT,  DTC  is  duplicating  improvement  efforts  underway  at  other  agencies 
attempting  to  address  similar  issues.  Recent  DTC  steps  toward  better  collaboration 
are  a  step  in  the  right  direction.  However,  more  could  be  done  to  coordinate  on  a 
government-wide  basis  to  streamline  the  federal  munitions  export  licensing  process 
as  a  whole. 


9  44  U.S.C.  3504  (2001) 

10  Public  Law  107-56,  115  Stat.  272  (2001) 
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Automating  Existing  Processes 

According  to  the  Clinger-Cohen  Act, 11  federal  agencies  are  required  to  analyze  and 
revise  missions  and  processes  before  making  significant  investments  in  IT  to  help 
improve  the  efficiency  and  effeedveness  of  their  operations.  DTC  recently  instituted 
a  number  of  initiatives  to  upgrade  IT  to  support  its  licensing  process.  However,  the 
approach  taken  has  been  primarily  one  of  automating  aspects  of  the  existing  process 
without  first  examining  the  underlying  process  and  considering  streamlining  alterna¬ 
tives.  DTC  initiatives  to  date  have  included: 

•  Web  Site  Enhancement:  DTC  redesigned  its  web  site  to  make  it  more 
user-friendly  for  exporters  and  ensure  compliance  with  Section  508  of  the 
Rehabilitation  Act  of  1973, 12  as  amended,  which  requires  that  all  federal  de¬ 
partments  and  agencies,  when  developing,  procuring,  maintaining,  or  using 
IT,  ensure  access  to  individuals  with  disabilities  comparable  to  people  with¬ 
out  disabilities. 

•  Dedicated  Telecommunications  Link:  DTC  is  working  to  increase  con¬ 
nectivity  with  Defense  through  installation  of  a  T-l  line — a  high  speed  digital 
connection  capable  of  transmitting  data  at  a  rate  of  approximately  1.544  mil¬ 
lion  bits  per  second.  The  T-l  line  is  to  provide  capability  to  send  and  receive 
very  large  text  files,  graphics,  sounds,  and  databases  instantaneously,  and  is 
the  fastest  means  commonly  used  to  connect  networks  to  the  Internet.  Via 
the  T-l  line,  Defense  will  be  able  to  transmit  electronically  to  DTC  its  final 
dispositions  on  applications  that  are  referred  to  them  for  review.  DTC  offi¬ 
cials  believe  that  this  line  will  prove  useful  for  rapid  turnaround  of  cases  in¬ 
volving  high-priority  munitions  needed  in  the  current  U.S.  counterterrorist 
effort. 

•  Contractor  IT  Assessments  and  Proposals:  DTC  laired  an  independent 
contractor  to  provide  support  in  documenting  and  certifying  its  munitions 
export  licensing  systems,  as  well  as  providing  recommendations  for  improve¬ 
ment,  i.e.,  database  conversions  and  front-end  electronic  submission.  In  ad¬ 
dition,  five  contractors  have  provided  strategies  for  enhancing  DTC’s  capa¬ 
bilities.  Another  contractor  is  developing  an  electronic  licensing  prototype 
for  DTC  consideration. 


11  Formerly  the  Information  Technology  Management  Reform  Act,  Public  Law  104-106,  Divi¬ 
sion  E,  110  Stat.  642  (1996). 

12  Public  Law  106-398,  114  Stat.  1654,  29  U.S.C.  701  et  seq.  (2001) 
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Such  automation  initiatives  are  a  step  in  the  right  direction.  However,  automating 
inefficient  business  practices  is  not  likely  to  make  them  more  efficient. 

Reengineering  and  streamlining  work  processes  are  essential  before  automating  those 
processes  and  effectively  transitioning  to  new  electronic  business  systems. 


Security  Concerns  Mot  Fully  Addressed! 

In  the  current  era  of  increasing  threats  to  information  processing  operations,  DTC 
must  consider  information  security  risks  as  it  works  to  upgrade  its  export  licensing 
systems.  Office  of  Management  and  Budget  Circular  A- 130  specifically  requires 
federal  agencies  to  incorporate  security  into  their  IT  architectures  to  ensure  effective 
support  for  agency  business  operations.  In  April  2001,  as  part  of  a  Government 
Information  Security  Reform  Act  review,  OIG  disseminated  a  questionnaire  to 
determine  whether  Department  organizations  were  meeting  IT  security  require¬ 
ments.  At  that  time,  DTC  officials  reported  that  they  had  not  completed  a  system 
risk  assessment  or  an  up-to-date  determination  of  the  level  of  security  required  to 
protect  their  Defense  Trade  Application.  DTC  officials  also  indicated  that  they  had 
not  developed  a  current  IT  security  plan  or  tested  or  evaluated  security  controls. 

In  recent  discussions,  DTC  officials  told  us  about  progress  they  have  since  made 
in  addressing  some  of  these  information  security  deficiencies.  For  example,  they 
hired  a  contractor  to  conduct  a  preliminary  risk  assessment  as  part  of  their  system 
documentation  effort.  The  purpose  of  the  assessment  was  to  identify  and  analyze 
vulnerabilities  and  potential  threats  to  their  web  site,  operational  interfaces,  and 
supporting  infrastructure.  As  a  result  of  the  assessment,  the  contractor  recom¬ 
mended  a  number  of  security  improvements  that  DTC  plans  to  implement  while 
modernizing  its  IT  infrastructure.  Additionally,  DTC  officials  said  that  they  arc 
working  with  the  Office  of  Verification  Operations  within  the  Bureau  of  Verification 
to  develop  an  IT  security  plan,  which  is  scheduled  for  completion  by  March  2002. 
They  are  also  coordinating  with  the  Department’s  Public  Key  Infrastructure  office, 
which  has  assigned  an  official  to  assist  DTC  on  information  protection  issues. 
Further,  DTC  intends  to  have  a  contractor  test  information  security  controls  as  new 
systems  are  implemented. 

However,  DTC  still  needs  to  obtain  an  up-to-date  determination  of  the  level  of 
security  required  to  protect  its  export  licensing  system  and  the  proprietary  munitions 
license  data  that  it  supports.  Once  such  a  determination  is  made,  DTC  will  have  to 
work  with  all  interested  parties  to  agree  on  a  security  approach  that  can  best  protect 
integrated  systems  and  exchange  of  licensing  data  across  agencies.  This  will  involve 
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close  coordination  to  ensure  that  DTC’s  licensing  system  and  security  measures  arc 
compatible  with  those  of  industry  and  other  federal  agencies  involved  in  the  muni¬ 
tions  license  review  process. 


Participants  Not  Adequately  Involved  in 
Defining  Requirements 

Department  regulations  advise  that  internal  organizations  use  the  Managing  State 
Projects  methodology  as  a  means  of  planning  and  implementing  IT  projects. 13  The 
methodology  provides  a  framework  for  communicating  and  coordinating  with  users 
to  define  system  and  user  requirements.  However,  DTC  is  not  using  the  methodol¬ 
ogy  to  structure  and  control  its  project  direction.  In  this  context,  DTC  coordination 
with  munitions  licensing  participants  on  upgrade  initiatives  has  also  been  limited, 
affecting  the  office’s  ability  to  identify  and  address  requirements. 

For  example,  industry  has  not  been  adequately  consulted  to  address  its  concerns 
about  the  licensing  process.  In  1992,  the  Department  chartered  a  Defense  Trade 
Advisory  Group  to  provide  feedback  on  munitions  export  issues  and  control  pro¬ 
cesses.  However,  DTC  has  not  used  this  group  effectively  to  help  improve  its 
processes.  Instead,  DTC  selects  the  issues  that  it  wants  the  group  to  focus  on  and 
then  does  not  always  follow  through  to  resolve  them.  As  a  result,  there  are  still  a 
number  of  industry  concerns  that  DTC  needs  to  address  as  part  of  its  ongoing  IT 
upgrade  initiative. 

Specifically,  guidance  and  standards  are  needed  to  assist  industry  in  submitting 
license  applications  to  DTC.  Industry  officials  told  us  that,  because  it  is  not  clear 
what  DTC  wants,  they  submit  different  information  each  time  they  apply  for  an 
export  license.  Some  exporters  reference  examples  of  prior  license  applications  to 
determine  what  information  is  needed  for  new  submissions  and  help  ensure  that  they 
are  complete.  Officials  from  one  industry  organization  stated  that  they  developed 
their  own  manual  to  assist  their  employees  in  submitting  license  applications  to  DTC. 
In  addition,  officials  from  another  industry  organization  said  that  they  experienced 
difficulty  meeting  DTC  license  application  requirements  because  of  differences  in 
technology.  These  officials  said  that  they  had  to  use  older  versions  of  technology  in 
order  to  submit  applications  electronically  to  DTC. 


13  Foreign  Affairs  Manual,  Chapter  5,  Section  620. 
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DTC  is  also  not  addressing  problems  that  regional  bureaus  are  experiencing  in 
the  license  review  process.  For  example,  officials  from  the  regional  bureaus  told  us 
that  they  require  only  a  limited  amount  of  information  to  review  an  export  license 
application.  However,  DTC  sends  them  all  license  data  received  from  an  exporter. 
This  lengthens  and  complicates  the  review  process  when  bureau  officials  have  to 
search  through  voluminous  amounts  of  paper  to  locate  information  needed  to 
formulate  licensing  determinations.  DTC  officials  stated  that  the  bureaus  have  not 
provided  them  with  specific  information  to  identify  bureau  interests  and  priorities  in 
the  export  license  review  process.  They  also  stated  that  they  provide  detailed  expla¬ 
nations  of  the  licensing  process  to  Department  bureaus  and  emphasized  the  impor¬ 
tance  of  having  adequate  staff  to  review  licenses. 

As  part  of  its  IT  enhancement  initiatives,  DTC  also  is  not  effectively  working  to 
meet  the  concerns  of  other  federal  agencies.  For  example,  Defense  officials  indi¬ 
cated  that  they  often  receive  insufficient  supporting  documentation  when  DTC 
refers  license  applications  to  them  for  review.  As  a  result,  Defense  officials  have  to 
contact  industry  for  additional  information  before  they  can  conduct  their  reviews 
and  formulate  decisions.  Additionally,  reviewers  at  Energy  stated  that  DTC  could 
improve  communications  and  coordination  between  their  organizations.  They  stated 
that  DTC  officials  do  not  readily  respond  to  inquiries  from  Energy  regarding  license 
applications  and  do  not  send  final  dispositions  to  Energy  on  munitions  cases  that 
they  reviewed. 


Duplication  of  Other  Agency  Efforts 

The  Clinger-Cohen  Act  requires  that  agencies  identify  IT  investments  that  could 
result  in  shared  benefits  or  costs  for  other  agencies  or  local  governments.  Further, 
Office  of  Management  and  Budget  Circular  A-130  requires  that  federal  agencies 
cooperate  on  the  use  of  IT  to  improve  productivity,  efficiency,  and  effectiveness  and 
ensure  that  planned  developments  or  improvements  to  existing  information  systems 
do  not  unnecessarily  duplicate  other  IT  initiatives.  However,  DTC  is  not  taking  full 
advantage  of  other  federal  organizations’  efforts  to  improve  the  export  licensing 
process.  A  number  of  these  organizations  are  addressing  some  of  the  same  issues 
that  DTC  faces,  including  standardization,  tracking,  electronic  transmission  of 
supporting  documentation,  and  information  security  in  the  export  licensing  process. 
For  example: 
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•  Commerce  is  upgrading  its  Export  Control  Automated  Support  System 
to  allow  exporters  to  transmit  license  applications  and  supporting  documen¬ 
tation  electronically,  while  securing  authentication  and  transmission  of  infor¬ 
mation  using  public  key  encryption. 

•  Defense  is  attempting  to  add  technical  specifications  to  its  DTSA  system 
and  allow  users  to  attach  notes  to  license  applications  electronically  sent  to 
other  Defense  components  for  review. 

•  Energy  frequently  upgrades  its  Proliferation  Information  Network  Sys¬ 
tem  to  improve  the  automation  of  its  review  of  dual-use  and  munitions  ex¬ 
port  license  applications. 

DTC  has  the  potential  to  save  time,  effort,  and  resources  by  working  jointly  with 
other  agencies  and  capitalizing  on  the  benefits  of  these  ongoing  improvement 
projects.  In  January  2001,  Defense  funded  and  established  a  U.S.  Export  System 
Program  Management  Office  (USXPORTS)  as  an  initial  interagency  effort  to  im¬ 
prove  automation  to  support  the  export  licensing  processes.  Specifically,  the  objec¬ 
tive  of  the  USXPORTS  program  is  to  design,  develop,  and  deploy  a  modern  elec¬ 
tronic  export  license  review  system  that  will  be  interoperable  among  Commerce, 
Defense,  State  and  other  relevant  government  agencies.  The  ultimate  goal  is  to 
support  the  export  control  process  with  easy  and  timely  electronic  access  to  perti¬ 
nent  export  data,  while  protecting  national  security  interests  and  industry  proprietary 
data.  However,  DTC  initially  considered  the  effort  an  internal  Defense  initiative  and 
did  not  participate. 


DTC  Steps  Toward  Collaboration 

In  recent  months,  DTC  has  taken  some  first  steps  to  coordinate  better  with  organi¬ 
zations  both  internal  and  external  to  the  Department  regarding  improving  automa¬ 
tion  of  the  export  licensing  process.  For  example,  DTC  has  increased  communica¬ 
tions  and  coordination  with  the  Bureau  of  Information  Resource  Management, 
which  has  responsibility  for  providing  technical  support  and  resources  and  identify¬ 
ing  opportunities  for  IT  improvement  within  the  Department. 

Externally,  DTC  officials  improved  their  communications  and  coordination  with 
the  USXPORTS  program  office  during  the  course  of  our  review.  For  example,  they 
recently  agreed  to  commit  contractors  to  work  with  the  USXPORTS  program  to 
enhance  connectivity  between  DTC  and  Defense  systems. 
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Recommendations 


We  recommend  that  the  Assistant  Secretary  for  Political-Military  Affairs  direct  the 
DTC  to  coordinate  with  representatives  from  industry,  the  Department’s  bureaus 
and  offices,  and  other  federal  organizations  involved  in  the  munitions  export  licens¬ 
ing  process  to  carry  out  the  following  as  a  means  of  improving  the  end-to-end 
process  and  supporting  technology: 

1 .  Identify  and  document  business  requirements,  including  the  need  for  electronic 
data  exchange,  among  all  participants  involved  in  the  munitions  export  licensing 
process; 

2.  Reengineer  the  process  to  address  identified  business  requirements  and  promote 
efficient  and  timely  license  processing; 

3.  Develop  and  implement  an  effective,  interoperable  IT  systems  approach  to 
support  electronic  data  exchange  in  the  reengineered  munitions  export  licensing 
process,  coordinating  with  the  Department’s  Chief  Information  Officer  on  a  con¬ 
tinuing  basis  to  ensure  oversight  of  the  planned  IT  systems  initiatives  and  invest¬ 
ments  and  their  confluence  with  federal  and  Departmental  requirements  for  manag¬ 
ing  IT;  and 

4.  Assess  information  security  risks  in  the  reengineered  munitions  export  licensing 
process  and  supporting  interoperable  systems  environment  and  develop  and  imple¬ 
ment  an  information  security  strategy  to  manage  those  risks  effectively. 


Department  Comments  and  Our  Evaluation 

We  obtained  written  comments  on  a  draft  of  this  report  from  the  Bureau  of  Politi¬ 
cal-Military  Affairs.  In  its  response,  the  Bureau  stated  that  it  accepted  the  report’s 
recommendations,  while  noting  that  several  remedial  activities  have  been  underway 
since  the  time  of  OIG’s  review.  The  Bureau  identified  ongoing  steps  it  believes  are 
responsive  to  the  report’s  findings  and  consistent  with  its  recommendations.  The 
Bureau  also  stated  that  beyond  the  recommendations,  much  of  the  report’s  analysis 
will  serve  as  a  basis  for  consideration  of  still  further  measures  to  strengthen  the 
timeliness  and  overall  efficiency  of  the  munitions  export  licensing  system. 
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We  appreciate  the  Bureau’s  responsiveness  and  proposed  actions  to  address  the 
issues  presented  in  our  report.  The  Bureau  requested  the  continued  close  involve¬ 
ment  of  the  OIG  as  its  initiatives  proceed  in  the  weeks  and  months  ahead.  We 
agreed  to  provide  such  assistance  on  an  ongoing  basis.  We  have  included  the 
Bureau’s  comments  in  their  entirety  at  Appendix  A. 
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Purpose,  Scope  and  Methodology 

The  National  Defense  Authorization  Act  (the  Act)  for  FY  2000  requires  the  Inspec¬ 
tors  General  of  Commerce,  Defense,  Energy,  and  State,  in  consultation  with  the 
Director  of  the  Central  Intelligence  Agency  and  die  Director  of  the  Federal  Bureau 
of  Investigation,  to  evaluate  and  report  annually,  from  FY  2000-07,  on  U.S.  policies 
and  procedures  for  the  export  of  technologies  and  technical  information  to  coun¬ 
tries  and  entities  of  concern.  In  response  to  requirements  of  the  Act,  this  year  the 
Department’s  OIG  conducted  a  review  of  automation  in  the  munitions  export 
licensing  process.  Specific  objectives  of  our  review  were  to  (1)  evaluate  the  pro¬ 
cesses  and  information  systems  used  by  the  Department  for  reviewing  munitions 
export  license  applications,  including  an  assessment  of  systems  connectivity  with 
other  relevant  bureaus  in  the  Department,  as  well  as  with  other  federal  agencies,  (2) 
determine  whether  the  licensing  systems  comply  with  federal  and  Departmental 
security  assurance  requirements,  and  (3)  assess  whether  ongoing  and  planned  up¬ 
grades  to  the  licensing  systems  are  being  carried  out  in  a  cost-effective  and  efficient 
manner. 

To  meet  these  objectives  we  first  researched  laws  and  federal  guidance  to  identify 
applicable  criteria  for  managing  and  ensuring  security  of  information  technology. 

We  then  met  with  managers  and  licensing  officers  in  the  Department’s  Office  of 
Defense  Trade  Controls  to  determine  whether  they  are  meeting  these  criteria  in 
managing  and  upgrading  their  systems  and  processes  to  support  the  munitions 
export  licensing  process.  Representatives  from  selected  industry  organizations  told 
us  how  they  interact  with  DTC  at  the  front  end  of  the  process  to  apply  for  export 
licenses.  Officials  from  various  bureaus  and  offices  within  the  Department  and 
representatives  from  the  Defense  Technology  Security  Administration  told  us  about 
their  processes  and  systems  for  reviewing  licenses  referred  to  them  from  DTC. 
Further,  Customs  officials  at  the  back  end  of  the  process  told  us  about  their  systems, 
procedures,  and  work  with  DTC  to  enforce  approved  licenses. 

Further,  we  attended  presentations  at  Defense,  Energy,  Commerce,  and  Customs 
to  learn  about  issues  they  are  grappling  with  and  initiatives  they  have  underway  to 
improve  IT  and  streamline  portions  of  the  export  licensing  process.  Officials  within 
the  Department’s  Bureau  of  Nonproliferation  also  told  us  about  their  Tracker  system 
for  electronic  submission  and  tracking  of  foreign  exporters’  license  applications.  In 
addition,  wc  met  with  representatives  of  the  USXPORTS  program  office  at  Defense 
to  discuss  their  approach  to  developing  an  integrated  export  licensing  system  for  the 
entire  U.S.  government.  Officials  in  all  of  these  organizations  discussed  with  us  their 
efforts  to  coordinate  with  DTC  on  their  automation  initiatives. 
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Internal  to  the  Department,  we  interviewed  budget  officials  in  the  Bureau  of 
Political-Military  Affairs  to  learn  about  their  role  in  funding  and  overseeing  DTC’s  IT 
investments.  Verification  officials  in  the  Bureau  of  Verification  and  Compliance  told 
us  about  measures  that  they  are  taking  to  ensure  that  DTC  is  complying  with  infor¬ 
mation  security  requirements.  Further,  we  met  with  officials  within  the  Bureau  of 
Information  Resource  Management  to  determine  their  coordination  with  and  over¬ 
sight  of  DTC’s  information  and  technology  management  operations.  Finally,  we  met 
with  representatives  from  GAO  to  discuss  their  review  comparing  the  export  licens¬ 
ing  processes  for  dual-use  and  munitions  licenses  and  their  follow-up  review  focusing 
on  DTC  processes. 

We  conducted  our  review  from  May  2001  to  December  2001  at  the  Department 
in  Washington  D.C.  We  conducted  our  review  within  the  context  of  an  overarching 
interagency  OIG  effort  to  assess  export  licensing  controls  automation,  which  will 
be  reported  on  separately.  We  performed  our  work  in  accordance  with  generally 
accepted  government  auditing  standards.  Major  contributors  to  this  report  were 
Frank  Deffer,  Sondra  McCauley,  Barbara  Ferris,  and  Vandana  Patel.  Comments  or 
questions  about  the  report  can  be  directed  to  Mr.  Deffer  at  defferf@state.gov  or  at 
(703)  284-2715. 
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Appendix  A 

United  States  Department  of  State 
Washington,  D.C.  20520 

FEB  12  2002 


INFORMATION  MEMORANDUM 


UNCLASSIFIED 


TO 

FROM: 


OIG-  Clark  Kent  Ervin 
PM  -  Lincoln  P.  Bloomfield, 


Jr 


* 


SUBJECT:  Memorandum  Report  IT-A-02-20  "Streamlined 

Processes  and  Better  Automation  Can  Improve 
Munitions  License  Reviews,  February  2002" 


I  appreciate  the  opportunity  to  comment  on  the  subject 
report.  PM  believes  that  the  OIG  audit  team  has  done  an 
excellent  job  in  assessing  and  framing  numerous  and 
complicated  issues.  I  regard  the  OIG  audit  team's  work  as 
conferring  both  potential  benefits  upon  the  PM  Bureau  and 
immediate  obligations  on  me  as  Assistant  Secretary. 

In  particular,  I  am  attentive  to  the  report's  finding 
that  expansion  of  PM ' s  electronic  licensing  function 
requires  timely  action  to  ensure  consistency  with  the 
intent  of  a  number  of  Office  of  Management  and  Budget 
directives  and  several  laws,  among  them  the  Clinger-Cohen 
Act;  the  Government  Paperwork  Elimination  Act  of  2001;  and 
the  Paperwork  Reduction  Act  of  1995.  Moreover,  I 
appreciate  and  accept  in  full  the  report's  Recommendations, 
noting  only  that  several  remedial  activities  are  under  way 
even  since  the  period  of  OIG's  review,  as  will  be  noted 
below.  Beyond  the  Recommendations,  much  of  the  report's 
analysis  will  serve  as  a  basis  for  PM's  consideration  of 
still  further  measures  to  strengthen  the  timeliness  and 
overall  efficiency  of  the  licensing  system. 

With  the  preceding  as  the  PM  Bureau's  summary  response 
to  the  OIG  report,  I  am  grateful  for  the  opportunity  to 
highlight  ongoing  steps  we  believe  to  be  responsive  to  the 
report's  findings  and  consistent  with  its  Recommendations. 
Where  we  have  differences  in  perspective  from  the  OIG 
report,  these  are  noted  below. 
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Steps  Underway  to  Redress  Problems  Cited  in  the  Report 


Licensing  Process  Re-engineering 

Although  no  public  announcement  has  yet  been  made,  PM 
is  in  the  early  stage  of  an  intensive  process,  initiated 
and  directed  by  me,  to  consider  process  improvements  aimed 
at  optimal  efficiency,  speed,  standardization,  and  ease  of 
management  of  the  State  Department's  munitions  licensing 
process.  I  have  carefully  reviewed  all  studies,  reports 
and  memoranda  submitted  to  the  Administration  to  recommend 
process  improvements  in  defense  trade  licensing.  From  that 
review  I  have  developed  a  notional  package  of  possible 
process  improvement  initiatives,  currently  numbering  around 
50.  This  package  is  being  reviewed  internally  at  PM.  I 
anticipate  that  some  items  may  come  off  the  list  while 
others  will  be  added. 

As  this  initial  review  is  concluded,  I  intend  to 
inform  the  Secretary  of  State  of  my  proposal  to  conduct  a 
comprehensive  process  review;  subject  to  his  guidance,  I 
would  intend  to  enlist  the  assistance  of  some  industry 
experts  via  the  Defense  Trade  Advisory  Group  (DTAG),  PM's 
federal  advisory  committee  for  these  matters,  and  involve 
counterparts  at  the  Departments  of  Defense  and  Commerce, 
where  appropriate,  as  well  as  the  National  Security  Council 
Staff  in  an  effort  to  refine  and  implement  process  reforms 
of  many  kinds.  Indeed,  the  above  entities  are  all  aware  of 
these  plans  and  have  pledged  their  cooperation  with  PM. 

A  range  of  issues  spotlighted  by  OIG,  such  as 
interagency  management  of  the  licensing  function,  end-use 
monitoring  for  exported  defense  items  and  technology,  the 
policy  referral  process  for  license  applications,  the 
commodity  jurisdiction  process,  and  timeliness  as  it 
relates  to  industrial  competitiveness,  to  name  several  key 
aspects  of  our  operation,  will  all  be  encompassed  in  the 
process  re-engineering  initiative  now  under  development. 

I  also  wish  to  underscore  that  PM's  Office  of  Defense 
Trade  Controls  (DTC)  takes  very  seriously  its  compliance  and 
enforcement  functions.  DTC ' s  operational  relationship  with 
the  U.S.  Customs  Service,  its  overseas  Blue  Lantern 
end-use  monitoring  program,  and  particularly  its 
responsibility  to  retain  and  produce  information  for  use  in 
administrative  or  criminal  proceedings,  impose  special 
process  and  information  management  requirements. 
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PM/DTC  Information  Technology  Upgrade 

On  a  related  front,  there  is  already  intense  interest 
in  the  Administration,  the  Congress,  and  the  U.S.  defense 
industry  in  the  upgrading  of  DTC ' s  computer  system.  I  am 
personally  engaged  in  this  effort  as  well  because  of  the 
important  national  security  and  foreign  policy 
considerations  intrinsic  to  export  licensing  and 
compliance/enforcement  activities.  I  also  take  this 
project  to  be  PM's  primary  means  of  fulfilling  the  State 
Department's  interests  in  promoting  e-Government .  I  am 
pleased  to  report  that  a  great  deal  of  constructive 
activity  has  occurred,  even  subsequent  to  the  conclusion  of 
the  OIG  inquiries,  that  moves  substantially  in  the 
direction  of  fulfilling  the  Recommendations  of  the  OIG 
audit  team: 

•  PM  has  now  entered  into  intensive  IT  dialogue  and 
activity  with  DoD,  to  include  several  meetings  with 
USXPORTS  technical  experts  and  expanded  use  of  a  T-l  line 
to  transmit  to  DoD  both  structured  data  and  unstructured 
back-up  materials  for  cases  in  support  of  Operation 
Enduring  Freedom. 

•  DTC  and  VC/VQ  (the  office  responsible  for  IT  matters  for 
the  four  bureaus  reporting  to  the  Under  Secretary  for 
Arms  Control  and  International  Security  Affairs)  have 
begun  to  implement  a  detailed  workplan  for  day-to-day  IT 
support  of  the  defense  trade  controls  function,  as  well 
as  to  address  Government  procurement  and  security  issues 

•  DTC  has  now  expanded  its  discussions  about  information 
security,  including  detailed  discussions  about  systems 
architecture  and  electronic  authentication  with  the 
Department's  PKI  Program  Office. 

•  The  Department's  CIO,  Mr.  Fernando  Burbano,  has 
assigned  personnel  from  IRM  operations  staff  to  work 
closely  with  DTC  in  a  number  of  areas  (e.g.,  process 
analysis  and  modeling,  systems  analysis  and 
development,  network  communications,  systems 
certification  and  accreditation  requirements,  and 
acquisition.  PM  is  committed  to  carrying  out  this 
upgrade  in  full  coordination  and  compliance  with  the 
Department ' s  management . 
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•  A  "proof  of  concept"  contract  has  provided  PM  with  a 

conceptual  model  of  a  fully  electronic  licensing  system. 

I  believe  we  have  firm  basis  for  systems  development 
this  year.  We  propose  to  focus  on  information  security  and 
risk  management,  database  conversion  (from  Microsoft 
Access) ,  and  the  technical  difficulties  in  handling 
voluminous  hardcopy  documentation  of  those  munitions  export 
cases  that  are  referred  to  DoD  and  other  offices/agencies. 
Using  the  electronic  licensing  "proof  of  concept"  as  a 
point  of  reference,  we  are  already  refining  a  "Concept  of 
Operations . " 

The  basic  near-term  achievement  of  fully  electronic 
licensing,  in  a  manner  readily  interoperable  with  the  other 
government  agencies  involved  in  defense  trade  licensing, 
will  in  no  way  prejudice  the  ongoing  process  re-engineering 
initiative.  At  this  time,  our  plans  include  business 
process  enhancements  for  munitions  export  licensing  review, 
some  of  which  would  be  incorporated  in  our  IT  development . 
In  the  very  near  future,  we  anticipate  proceeding  with  a 
contract  to  conduct  a  six-month  electronic  licensing  pilot 
program  (beta  testing  involving  several  defense  firms,  to 
include  database  conversion.  PM  will  work  closely  with  the 
private  sector,  IRM,  and  other  offices  and  agencies  to 
which  munitions  cases  are  referred. 

Further  information  technology  upgrades  and  management 
tools  that  are  deemed  desirable  on  the  basis  of  the  process 
re-engineering  initiative  will  be  contemplated  as  future 
enhancements,  building  on  the  electronic  foundation  being 
established  at  this  time.  Thus,  PM  fully  intends  that 
these  initiatives  fulfill  the  requirements  of  the  Clinger- 
Cohen  Act . 

In  sum,  PM  intends  to  fulfill  the  OIG  recommendations 
through  a  refinement  and  enhancement  of  defense  trade 
control  processes,  operational  guidelines,  management  tools 
and  collaborative  IT  enhancement.  We  will  be  pleased  to 
keep  the  OIG  team  apprised  of  our  actions  and  will  welcome 
any  and  all  feedback  on  our  progress  as  part  of  the  follow¬ 
up  to  the  subject  report.  Indeed.  I  invite,  and  will 
appreciate,  the  continued  close  involvement  of  the  GIG  as 
these  initiatives  proceed  in  the  weeks  and  months  ahead. 
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